BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
-
A newly identified UEFI bootkit dubbed BlackX was used in an espionage campaign in early 2026, leveraging the older Baton Drop vulnerability to bypass Secure Boot. Once Secure Boot protections were circumvented, the bootkit loaded a malicious driver specifically built to interfere with security solutions from Kaspersky and Avast.
The key points from the report:
- BlackX is a UEFI bootkit deployed in an espionage operation.
- It exploits the Baton Drop flaw to bypass Secure Boot.
- The payload includes a malicious driver designed to interfere with security products from Kaspersky and Avast.
Since the bootkit targets the boot chain before the operating system loads, traditional protections can be undermined early in startup, making detection and remediation more difficult for defenders.
Source: Unknown
Has your organization reviewed Secure Boot and boot-chain integrity protections against bootkit threats like this?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login